Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
03-10-2023 08:12
Static task
static1
Behavioral task
behavioral1
Sample
proof of payment.js
Resource
win7-20230831-en
General
-
Target
proof of payment.js
-
Size
941KB
-
MD5
aefbde8b2feb2370f55b45f7c9fb33f8
-
SHA1
5bcee2dc04e6bef1c9753ef1b8d86e55a46a94de
-
SHA256
a4091f479b77f96865cd035492ce534e54dfaa59178cf74e2a045fa5d0916b8c
-
SHA512
8657a53c5efc479c26e29fab3c058784420224e5c511a1b70bb9ad187a5d3719a7abf265b6e1ad64ffd17cb295c29a674086276594534efeb69d8858fcc4733d
-
SSDEEP
6144:MQPp6tU2vR4K1zzGxx29tUHwYwdetKadJjXqs4TSBdWHYa7iiRhqb0YDFL0jEhHb:Xj9
Malware Config
Extracted
wshrat
http://harold.2waky.com:1604
Signatures
-
Blocklisted process makes network request 21 IoCs
flow pid Process 19 3028 wscript.exe 22 3028 wscript.exe 43 3028 wscript.exe 50 3028 wscript.exe 51 3028 wscript.exe 60 3028 wscript.exe 66 3028 wscript.exe 67 3028 wscript.exe 68 3028 wscript.exe 70 3028 wscript.exe 73 3028 wscript.exe 77 3028 wscript.exe 81 3028 wscript.exe 82 3028 wscript.exe 83 3028 wscript.exe 93 3028 wscript.exe 94 3028 wscript.exe 95 3028 wscript.exe 96 3028 wscript.exe 97 3028 wscript.exe 102 3028 wscript.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation wscript.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\proof of payment.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\proof of payment.js wscript.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 18 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Script User-Agent 20 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 51 WSHRAT|D05E0829|RYHSSIAS|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 3/10/2023|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 66 WSHRAT|D05E0829|RYHSSIAS|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 3/10/2023|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 68 WSHRAT|D05E0829|RYHSSIAS|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 3/10/2023|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 70 WSHRAT|D05E0829|RYHSSIAS|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 3/10/2023|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 82 WSHRAT|D05E0829|RYHSSIAS|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 3/10/2023|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 97 WSHRAT|D05E0829|RYHSSIAS|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 3/10/2023|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 22 WSHRAT|D05E0829|RYHSSIAS|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 3/10/2023|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 43 WSHRAT|D05E0829|RYHSSIAS|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 3/10/2023|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 60 WSHRAT|D05E0829|RYHSSIAS|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 3/10/2023|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 67 WSHRAT|D05E0829|RYHSSIAS|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 3/10/2023|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 93 WSHRAT|D05E0829|RYHSSIAS|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 3/10/2023|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 50 WSHRAT|D05E0829|RYHSSIAS|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 3/10/2023|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 73 WSHRAT|D05E0829|RYHSSIAS|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 3/10/2023|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 77 WSHRAT|D05E0829|RYHSSIAS|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 3/10/2023|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 83 WSHRAT|D05E0829|RYHSSIAS|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 3/10/2023|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 94 WSHRAT|D05E0829|RYHSSIAS|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 3/10/2023|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 81 WSHRAT|D05E0829|RYHSSIAS|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 3/10/2023|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 95 WSHRAT|D05E0829|RYHSSIAS|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 3/10/2023|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 96 WSHRAT|D05E0829|RYHSSIAS|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 3/10/2023|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 102 WSHRAT|D05E0829|RYHSSIAS|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 3/10/2023|JavaScript-v3.4|NL:Netherlands -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 208 wrote to memory of 3028 208 wscript.exe 87 PID 208 wrote to memory of 3028 208 wscript.exe 87
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\proof of payment.js"1⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\proof of payment.js"2⤵
- Blocklisted process makes network request
- Drops startup file
PID:3028
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
941KB
MD5aefbde8b2feb2370f55b45f7c9fb33f8
SHA15bcee2dc04e6bef1c9753ef1b8d86e55a46a94de
SHA256a4091f479b77f96865cd035492ce534e54dfaa59178cf74e2a045fa5d0916b8c
SHA5128657a53c5efc479c26e29fab3c058784420224e5c511a1b70bb9ad187a5d3719a7abf265b6e1ad64ffd17cb295c29a674086276594534efeb69d8858fcc4733d
-
Filesize
941KB
MD5aefbde8b2feb2370f55b45f7c9fb33f8
SHA15bcee2dc04e6bef1c9753ef1b8d86e55a46a94de
SHA256a4091f479b77f96865cd035492ce534e54dfaa59178cf74e2a045fa5d0916b8c
SHA5128657a53c5efc479c26e29fab3c058784420224e5c511a1b70bb9ad187a5d3719a7abf265b6e1ad64ffd17cb295c29a674086276594534efeb69d8858fcc4733d